Skip to main content

Removing sIDHistory attribute


When using PowerShell Commands for Active Directory modifications on AD objects are scripted easily.
But dealing with some properties (e.g., sIDHistory) requires a special approach.

Let's say we need to clear the sIDHistory for the account TEST01
This account does have the sIDHistory attribute populated



[PS] C:\>$user=Get-QADUser -SamAccountName TEST01  -IncludedProperties sidhistory


[PS] C:\>$user.sIDHistory
0105000000000005150000002B012212B316AD0EEE04CFAD576F1600


If we want to clear an attribute like DisplayName we can use Set-QADUser and set the attribute to $null like this:


[PS] C:\>Set-QADUser $user -ObjectAttributes @{DisplayName=$null}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...

or that

[PS] C:\>Set-QADUser $user -ObjectAttributes @{DIsplayName=@{delete=$user.DisplayName}}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...



But what happens when we try the same syntax for sIDHistory:


[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=$null}
Set-QADUser : General access denied error
At line:1 char:12
+ Set-QADUser  <<<< $user -ObjectAttributes @{sidhistory=$null}
[PS] C:\>



This didn't work. Let's try the second option.

[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=@{delete=$user.sidhistory}}
Set-QADUser : The specified directory service attribute or value does not exist
. (Exception from HRESULT: 0x8007200A)
At line:1 char:12
+ Set-QADUser  <<<< $user -ObjectAttributes @{sidhistory=@{delete=$user.sidhistory}}

we got a different error. At least it doesn't complain anymore about the permissions. But how can we specify sIDHistory? If we check the property of the object with get-member we'll find out that

sIDHistory                    NoteProperty          System.String sIDHistory..

is a NoteProperty and as such it needs to be referenced as  $user['sidhistory'] (it's case-insensitive).

And after that we can finaly clear the sIDHistory attribute

[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=@{delete=$user['sidhistory']}}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...



Comments

Post a Comment

Popular posts from this blog

Create 3-Node Windows 2012 Multi-subnet Cluster

Environment There are two Data centers connected via a WAN link. Two Windows 2012 Servers (called SQLDEV1 and SQLDEV2) are located in the Primary Data Center (on the IP subnet 192.168.79.0/24) and the third server is placed in the Secondary Data Center with the 192.168.69.0/24 subnet. We’ll be creating a three-node Windows cluster with no shared storage on the multi subnet network with a file share witness at the Primary Data Center. We’ll be using a file share witness to protect from the cluster failure in a situation when the network between the Data Centers is unavailable and one of the servers in the Primary Data Center is also down (or being rebooted). The final state will look like depicted above: -           Two Virtual IP’s will be assigned (192.168.76.218 and 192.168.69.134) to the cluster -           The servers at the Primary Data Center will have a vote (Vote=1) and the ...
2 comments
Read more

Joining Windows 10 to Azure AD Domain

As of October 2016 to join Windows 10 computers to Azure AD Domain service requires these steps: Create a VNET in the classic portal . The VNET must be placed to a region where Azure AD domain service is available (( https://azure.microsoft.com/en-us/regions/services/ )  In the classic portal  go to Directory -> Configure and enable the domain service. And wait for ~ 30 min When completed the IP address will be populated Go back to the VNET configuration and add a DNS server with the IP (10.0.0.4 in this case) Create the "AAD DC Administrator" administrators group (again in Directory -> Group). Members of this group are granted administrative privileges on machines that are domain-joined to the Azure AD Domain Services managed domain. Add to the group your users who are supposed to have the administrative access on a Windows 10 computer go to Settings -> Accounts (this is true for Windows 10 version  1607) then select 'Access...
1 comment
Read more

SQL 2012 AlwaysOn: Synchronous vs. Asynchronous commit. Performance impact

Recently I've had a chance to build a 3-server AlwaysOn environment distributed between the primary and secondary data centers. The configuration looks like this: Primary Data Center                         Secondary Data Center                        SQLDEV1                                        SQLDEV3          SQLDEV2 The availability group was crated with synchronous commit replicas on SQLDEV1 and SQLDEV2 and the replica on SQLDEV3 was configured for asynchronous commit. The link between the data centers was not great and when I pinged SQLDEV3 from SQLDEV1 I got these results Approximate round trip times in milli-seconds:     Minimum = 39ms, Maximum = 63ms, Average = 42ms I also created a very simp...
4 comments
Read more